fix(deps): bump yanked spin 0.9.8/0.10.0 to 0.9.9/0.10.1

[bug-ops]

Summary

• cargo audit / cargo deny check advisories flagged the transitively-pinned spin crate as yanked at two versions in Cargo.lock: 0.9.8 (via flume 0.12.0 -> sqlx-sqlite 0.9.0 -> sqlx 0.9.0) and 0.10.0 (via pprof 0.15.0, bench feature).
• Both have non-yanked patch releases already within the existing semver ranges (0.9.9 and 0.10.1), so this is a Cargo.lock-only bump via cargo update -p spin@X --precise Y — no Cargo.toml changes.

Closes #6249

Test plan

• cargo deny check --config .github/deny.toml advisories -> advisories ok, yanked warning gone
• cargo audit -> 0 vulnerabilities, no spin/yanked matches
• cargo nextest run --config-file .github/nextest.toml --workspace --features "desktop,ide,server,chat,pdf,scheduler" --lib --bins -> 13692 passed, 0 failed
• cargo test --doc --workspace --features "desktop,ide,server,chat,pdf,scheduler" -> 0 failed
• cargo check --workspace --all-targets --features bench -> clean (bench feature is the only path to spin 0.10.x via pprof)
• cargo +nightly fmt --check, cargo clippy --profile ci --workspace --all-targets --features "desktop,ide,server,chat,pdf,scheduler,testing" -- -D warnings, rustdoc gate -> all clean
• git diff scoped to exactly the two spin package blocks + dependents' inline pin refs, plus a CHANGELOG.md entry; no Cargo.toml touched